Privacy Policy

Article 1 — Data Controller

The data controller is AFTERSCHOOOL SAS, represented by Céline HAZLEWOOD and Anthony LEZIN. Contact: [email protected].

Article 2 — Data Collected

The following data is collected for the purposes of managing enrolments and monitoring attendance:

• Name and contact details of the Client (email, phone number)
• Name, age and year group of the Student
• School or institution attended
• Payment data (for receipt purposes only — no banking data is stored)
• Attendance records

Afterschoool does not collect any health data, data relating to special educational needs (dyslexia, ADHD, etc.), or any sensitive data within the meaning of the GDPR.

Article 3 — Purposes of Processing

• Administrative management of enrolments and invoicing
• Organisation of groups and timetables
• Attendance tracking
• Communication with families regarding the delivery of the service
• Compliance with legal and accounting obligations

Article 4 — Data Retention

• Enrolment and billing data: 10 years (statutory accounting obligations)
• Attendance data: 3 years
• Contact details: duration of the contractual relationship + 3 years

Article 5 — Rights of Data Subjects

In accordance with the GDPR, every Client or adult Student has the right to access, rectify, erase, port and object to the processing of their personal data. These rights may be exercised by email to [email protected].

For minor Students, these rights are exercised by their legal guardian.

Article 6 — Data Sharing

Personal data is not shared with any commercial third party. Data may be shared with the AfterSchooolab platform (published by DEEPTHINK PARTNERS LLC) solely for the purpose of managing the platform access included in the enrolment.

Article 7 — Availability Questionnaire

Data collected via the online questionnaire (afterschoool.com/questionnaire): parent's name and email, first name, age and year group of each child, subject(s) of interest, availability slots.

Purpose: to organise lesson groups according to each family's availability following our enrolment campaign.

Legal basis: the parent's free and informed consent (GDPR art. 6.1.a) — information is provided voluntarily by completing the form.

Storage: responses are both transmitted by email to the After Schoool team (via Brevo, hosted in the European Union) and stored in encrypted form by our database processor Neon (European Union hosting — Frankfurt). See Article 8 for details.

Recipients: exclusively the After Schoool team (Anthony LEZIN, Céline HAZLEWOOD). No commercial sharing, no advertising use.

Retention period: received emails are kept for the duration of the enrolment campaign (maximum 3 months) and then deleted. Responses stored in the database are kept for three (3) years after the last contact with the family, in accordance with Article 8. In case of effective enrolment, relevant data is incorporated into the student's file (see Article 4).

Rights: you may at any time request access to, rectification of, or deletion of your data by writing to [email protected]. Response within 30 days. You may also lodge a complaint with the CNIL (www.cnil.fr) in case of dispute.

Article 8 — Database processor (Neon)

Submissions received via the contact and questionnaire forms are stored in a PostgreSQL database managed by our processor Neon, Inc. (110 Sutter Street, Suite 444, San Francisco, CA 94104, USA — entity certified under the EU-U.S. Data Privacy Framework).

Data location: physical hosting within the European Union, AWS Frankfurt region (eu-central-1). The data does not leave EU territory for storage purposes.

Encryption: TLS connections mandatory (SSL/TLS), data encrypted at rest.

Retention: submissions are kept for three (3) years after the last contact with the family, then deleted. Submissions linked to an effective enrolment are subsequently transferred to the student's file (Article 4).

Right to erasure: you may at any time request the deletion of your submission by writing to [email protected]. Effective deletion within 30 days.